Is CVE-2026-43901 actively exploited?

No active exploitation of CVE-2026-43901 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-43901 be exploited remotely?

Yes. CVE-2026-43901 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-43901?

CVE-2026-43901 has a CVSS score of 6.8 (MEDIUM).

HOME VULNERABILITIESCVE-2026-43901

MEDIUM

CVE-2026-43901

CWE-22Published: May 11, 2026· Updated: May 13, 2026

6.8

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:13.8th

Official Description

Wireshark MCP is an MCP Server that turns tshark into a structured analysis interface, then layers in optional Wireshark suite utilities. In 1.1.5 and earlier, wireshark-mcp exposes a wireshark_export_objects MCP tool that accepts an attacker-controlled dest_dir parameter and passes it to tshark's --export-objects flag with no mandatory path restriction. The path sandbox (_allowed_dirs) is None by default and only activates when the environment variable WIRESHARK_MCP_ALLOWED_DIRS is explicitly set. In a default installation, any directory on the filesystem can be used as the export destination.

NVD Source

Technical Analysis

CVE-2026-43901 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 6.8.